• FATF Recommendation No. 8, and the risks of overregulation

Sri Lanka is considering a new Non-Governmental Organisations (NGOs) (Registration and Supervision) Act of 2026 (“the Bill”), which would repeal and replace the Voluntary Social Services Organisations (VSSOs) Act, No. 31 of 1980. The Bill is being advanced during Sri Lanka’s ongoing Financial Action Task Force (FATF) mutual evaluation cycle and appears intended to demonstrate progress on anti-money laundering, countering terrorist financing (AML/CTF) obligations. However, several features of the draft raise concerns that Sri Lanka may be misapplying FATF Recommendation Eight (R 8) by treating large portions of the non-profit sector as subject to blanket regulation and supervision rather than adopting the targeted, risk-based approach that the FATF now requires.

Why the Bill raises concerns?

The proposed Law is not limited to organisations that may pose demonstrable terrorist financing (TF) risks. Instead, it would create a broad registration and supervisory regime covering a wide range of entities, including VSSOs, trusts, societies, companies limited by guarantee receiving foreign funds, advocacy organisations, informal associations, and many organisations already regulated under other laws.

Key provisions include: the Mandatory registration of non-profit entities; Re-registration requirements every three years; Broad powers for authorities to inspect premises, demand documents, obtain staff-related and financial information, and supervise NGO activities; Obligations on NGOs to “align with the policies of the Government”; Restrictions on certain advocacy activities during election periods; Suspension and deregistration powers based on vague grounds including threats to “sovereignty”, “territorial integrity”, “public order”, and “national security”; Extensive activity-related and financial reporting requirements, regardless of the organisational size or risk profile; and Notification requirements for crowdfunding activities.

Many of these measures have little or no direct relationship to TF risk mitigation. Instead, they represent overreach into the operations of civil society organisations, in contravention of international law and the freedom of association.

Inconsistencies with the current FATF approach

The Bill appears to regulate the entire non-profit sector rather than the subset of organisations identified as vulnerable to TF abuse.

The FATF’s revised Recommendation 8 and accompanying Best Practices Paper were specifically designed to move countries away from this approach. The FATF has repeatedly emphasized that: Governments should not treat the entire non-profit sector as inherently high-risk. The FATF has stressed that only a small portion of non-profit organisations (NPOs), if any , may face high TF-abuse risk.; Countries should first identify which entities fall within the FATF’s definition of NPOs and determine which are actually vulnerable to TF abuse.; The FATF has clarified that NPOs do not need to be treated like banks or other reporting entities, and are not required to conduct customer due diligence.; Any measures adopted should be targeted, evidence-based, and risk-based.; AML/CTF measures should not unnecessarily disrupt legitimate charitable or civic activities.; and Overregulation and the suppression of the civil society are now recognised by the FATF as unintended consequences that countries should avoid.

Several provisions of the Bill could be viewed as examples of the very type of sector-wide regulation that the FATF has spent recent years discouraging.

Why the Bill could create R 8 problems rather than demonstrate compliance?

Three particularly significant concerns may be relevant to Asia/Pacific Group on Money Laundering assessors.

The framework is not genuinely risk-based

Rather than identifying higher-risk organisations and tailoring measures accordingly, the Bill imposes highly restrictive requirements across a broad range of organisations, regardless of their actual TF risk profile.

Many provisions have no clear TF nexus

Requirements that NGOs align with Government policy, restrictions on advocacy, and suspension powers tied to concepts such as sovereignty or territorial integrity do not appear linked to identified TF risks. Their inclusion could suggest that AML/CFT objectives are being used to justify broader restrictions on the civil society.

The Bill may demonstrate the over-implementation of Recommendation 8

Recent FATF evaluations increasingly examine whether countries understand non-profit-sector risks and apply proportionate safeguards. A framework that is resource intensive to implement, unlikely to address the actual TF risk, and burdensome on independent civic activity, may raise questions about whether Sri Lanka has correctly implemented the revised Recommendation 8 framework.

Relevant international examples

Several recent assessment processes illustrate the FATF’s evolving approach.

Venezuela

FATF assessors criticised the Government’s conclusion that NGOs represented a major TF threat because the Government had provided little evidence to support this claim, including an insufficient risk assessment. The FATF found that broad controls imposed across the sector were not adequately evidence-based. Consequently, Venezuela received a Non-Compliant rating on Recommendation 8.

India

In 2024, the FATF rated India only Partially Compliant on Recommendation 8, calling for a more risk-based and outreach-oriented approach toward non-profits. The evaluation highlighted concerns regarding whether certain regulatory measures were targeted and proportionate, and whether the Government had undertaken sufficient consultations with the sector.

Argentina

Argentina removed NPOs from the list of AML/CFT “obliged entities” in 2024, significantly reducing compliance and reporting burdens and aligning its framework with the FATF’s revised Recommendation 8, focused on proportionate, risk-based measures.

South Africa

During the FATF-related reforms associated with grey-listing, policymakers and the civil society repeatedly and publicly emphasised that the FATF does not require blanket controls over all non-profits and that measures should focus on genuinely higher-risk organisations.

These examples demonstrate that the FATF increasingly scrutinises not only whether NPOs are regulated, but whether regulation is appropriately tailored to identified risks.

Potential implications for GSP+

The European Union places significant weight on the implementation of international human rights conventions, including the International Covenant on Civil and Political Rights (ICCPR). If the Bill is viewed as restricting the freedom of association or the civic space, it could attract scrutiny within broader Generalised Scheme of Preferences Plus (GSP+) monitoring discussions. The fact that restrictions are being justified through AML/CFT objectives are unlikely to mitigate these concerns, particularly where measures appear broader than the FATF itself requires.

The FATF is increasingly focused not just on whether countries regulate NGOs, but on whether those measures are risk-based and developed with meaningful engagement with the sector. Recent evaluations and reforms show that overbroad NGO controls can now become a FATF concern, and potential grounds for being downgraded on Recommendation 8.

Rather than evidence of effective R.8 implementation, Sri Lanka’s draft NGO Law risks being perceived as an example of the overbroad regulation of the civil society. By imposing sector-wide controls and regulating activities unrelated to terrorist financing risk, the Bill may undermine rather than strengthen Sri Lanka’s case that it has implemented a targeted and risk-oriented R.8 framework.

Sri Lanka’s Government is currently considering the NGOs (Registration and Supervision) Act of 2026 (draft Act or Act), which would repeal and replace the VSSOs (Registration and Supervision) Act, the Law currently governing a form of voluntary not-for-profit organisation in Sri Lanka.

There are seven key concerns with the draft Act.

Mandatory registration

The draft Act requires NGOs to register with the Competent Authority, prohibiting the existence of unregistered groups, which constitutes an impermissible restriction on the freedom of association under international law applicable to Sri Lanka (Article 22 of the ICCPR). This could have a severe chilling effect on the freedom of association, especially for small and informal groups, and undermine the people’s right to form and operate different types of groups.

Compounding the problem, the draft Act applies to virtually all types of civil society groups in Sri Lanka, including VSSOs, microfinance organisations, entities registered under the Companies Act receiving foreign funds to engage in non-profit or voluntary activities, associations, trusts, societies, and certain organisations incorporated under other laws. As a result, organisations that have already been lawfully established under existing legal frameworks would be required to obtain an additional registration in order to operate. This not only creates duplicative and burdensome requirements, but also interferes with the freedom of individuals to choose the legal form through which they associate and pursue common purposes.

By making the continued operation of organisations already established under other laws dependent on approval from the Competent Authority, the draft Act centralises Government control over a broad range of civil society activity and implicates both international and Sri Lanka’s constitutional guarantees of the freedom of association.

The mandatory notification of activities

While religious organisations, licensed banks, public and private companies, cooperative societies, partnerships, school development societies, alumni associations, and trade unions are excluded from the Act’s registration requirement, these organisations would be required to notify the Competent Authority of voluntary social services activities or projects meeting certain criteria (See draft Act, Section 2[3] stating that “any organisation referred to in paragraphs [a] to [f] [that] intends to engage in any voluntary social services activity or voluntary social services project, which is – [a] in the case of [a], not religious in nature; or [b] in the case of [b] to [f], not provided for in the articles of association or in the constitution of such company, partnership, society, association or union, as the case may be, such organisation shall notify the Competent Authority of such activity or project, and the Competent Authority may require such organisation to register such activity or project with the Competent Authority for the purposes of this Act”). The Competent Authority may require the registration of such activities or projects, thus further expanding Government control over the non-profit sector. Such requirements would be burdensome for the affected entities and could deter them from conducting voluntary activities.

Burdensome registration procedures

The draft Act fails to define objective criteria to assess registration applications; the documentation an NGO must submit with its registration application; or the timeline for the Government review of applications. These regulatory gaps invite arbitrary and subjective decision-making that could result in indefinite delays, excessive demands for documentation, and the denial of registration to disfavoured organisations. In addition, the draft Act fails to allow applicants to appeal the denial of registration, contravening international standards and good regulatory practices. These regulatory features are especially concerning given the authorities’ past use of burdensome and arbitrary legal procedures to restrict the civil society and voices of dissent.

The draft Act requires NGOs to apply to renew their registration every three years. This is burdensome for both regulators and the NGOs, and, where procedures are subject to Government discretion, can be misused to impede the renewal of NGOs whose activities are sensitive or deemed controversial by the Government.

Invasive supervisory powers

The draft Act envisions a Competent Authority that would have supervisory powers to (1) facilitate, coordinate and evaluate programs and projects implemented by NGOs and develop mechanisms to review NGOs; (2) promote accountability and transparency in NGOs “by encouraging NGOs to self-adopt and maintain codes of ethics … and by supervising the performance” of NGOs; and (3) enter any premises of any NGO with a peace officer, including without a search warrant, “upon prior notice at any reasonable time of the day”, among other powers which the Competent Authority may exercise without judicial oversight.

First, the broad and open-ended language of these powers (e.g. “supervising performance” and to “coordinate and evaluate programs and projects”) could invite Governmental interference in NGOs’ activities and internal affairs. Second, the Government is often not well-placed to evaluate NGO programming, as regulators do not typically have sufficient expertise or familiarity with NGOs’ projects. Third, the Government authority to enter an NGOs’ premises without a court order and without providing notice to the NGO could lead to privacy violations and excessive demands for documentation from NGOs.

NGO Register raises privacy concerns

The draft Act directs the Competent Authority to maintain a public register of NGOs and states that the manner, form, and contents of the Register will be “prescribed.” The failure to specify the information that the NGO register will contain is concerning because Governments sometimes use NGO registers to require and make publicly available personal data about NGOs’ officials, employees, or beneficiaries. Public NGO registers should typically only contain basic information relating to NGOs such as the name, address, registration number, and the date of registration of an NGO.

Duties and prohibitions on NGOs

The draft Act prohibits NGO activities that “adversely affect the sovereignty or territorial integrity of Sri Lanka” or “induce or cause any public disorder which affects the safety and interests of the general public”; and “advocacy to support political ideologies using funds and resources of the NGO during a period of pre-election, or unless it is an object of such NGO.” The language of these prohibitions is vague and overly broad, and therefore subject to arbitrary interpretation, which could enable the targeting of legitimate activities.

The draft Act also imposes a new duty on NGOs to “align with the policies of Government.” This constitutes a severe restriction on NGOs’ freedom of association, as NGOs should be free to determine their activities and purposes, whether or not they align with official policy.

The draft Act also applies the same activity and financial reporting requirements to all NGOs, regardless of the size or scope of the operations. For instance, all NGOs must prepare an annual report, periodic returns, and an audit of accounts, which could be burdensome for small organisations. Further, the Competent Authority is authorised “to request and obtain any information, including any action plan, progress reports, staff details, fund flow, and account details from any NGO” which could enable unreasonable and intrusive demands.

The draft Act requires an NGO to “notify the Competent Authority prior to the initiation of any crowdfunding activity” (Section 23 defines “crowdfunding” as “the practice of funding a project or venture by raising money from a large number of people.”). Such a requirement could allow excessive Government scrutiny over NGOs’ fundraising activities and discourage NGOs from fundraising. For instance, a small NGO would be required to notify the Government of a crowdfunding campaign to raise community funds to support a neighbourhood library (Because the definition of “crowdfunding” includes “raising money from a large number of people”, even a relatively small crowdfunding campaign focused on members of a local community could be deemed “crowdfunding” as there are no objective criteria to assess what constitutes a “large number of people”), thereby deterring the NGO from pursuing the initiative.

Deregistration, suspension, and group liability

The draft Act provides that an NGO may be deregistered either by the Competent Authority or by order of a competent court. To align with international standards and good practice, the Act should instead provide that deregistration may only be accomplished through a court order. This will ensure that this severe sanction is only applied upon approval by a competent, neutral body and not by an institution potentially subject to political control.

The draft Act also allows for the suspension of an NGO’s registration upon several vague grounds, including where there is “prima facie evidence” that the NGOs’ activities and existence are “prejudicial or a threat to national security, territorial integrity, (or) sovereignty.” Terms such as “territorial integrity” and “sovereignty” are extremely broad and vague, providing regulators wide discretion to determine when there has been a violation. This could enable the suspension of an NGO’s registration based on arbitrary or selective grounds.

The draft Act imposes liability for offenses committed under the Act by any “body of persons” on every director and officer of a corporate body, and every office bearer of the board for organisations with a board of management, unless the individual proves that the offence was committed without his or her knowledge and that he or she exercised “all due diligence to prevent the commission of the offence.” This runs counter to standard regulatory practices in most countries, where limited liability protects all legal entities, including both for-profit and not-for-profit organisations. Under a system of limited liability, directors, officers, and board members may be liable only if it is proven in a court of law that they committed an act willfully or failed to act reasonably and in good faith.

The ICNL is an organisation striving to strengthen the legal environment for the civil society, philanthropy, and public participation around the world, and works with civil society organisations, Governments, and the international community